A vendor pitched us an AI tool for resume screening. The demo was slick. The contract was one click away. And the one question I couldn't answer — the one that should have been answered before anyone opened the contract — was whether resume screening even counts as high-risk under the EU AI Act.
Annex III is the list that decides that. I'd skimmed it and convinced myself we were fine. Skimming is not classification, and "I'm pretty sure" is a bad basis for a signing decision.
The case against the model, for this job
Annex III is a written enumeration of high-risk use cases — recruitment, credit scoring, biometric ID, and a set of others, each described in text. Classifying your use case against it is matching, not judgement. There's no fuzzy space where a model's reasoning adds value, and plenty of space where its confidence adds risk.
A model asked "is this high-risk?" will split the difference and tell you "likely moderate," which is not a category the Act contains. AnnexPath keeps the logic on the written list: you describe the use case, it walks the Annex III categories, and it tells you which ones your facts map to — or that nothing matches, which is also a valid and useful answer.
The value isn't a verdict. It's forcing the question before budget is committed, when changing course is cheap, instead of after the contract is signed and the obligation is yours.
What it deliberately does not do
- It is not legal advice. Classification is decision-support; a qualified person confirms it.
- It does not certify your use case as low-risk. "Nothing matched" is a signal, not a clearance.
- It covers classification only. What you owe afterwards — deployer duties, vendor vetting — is a different tool.
- It can't see your contract. It reasons from the use case you describe, not the terms you're about to sign.
Before the next AI contract lands on your desk, AnnexPath is $19/mo and answers the Annex III question first. If the answer is high-risk, you've saved yourself a signature you'd regret.
Top comments (0)